Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

mcp-atlassian — Vulnerabilities & Security Advisories 34

All 34 CVE vulnerabilities found in mcp-atlassian, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security advisories for the mcp-atlassian product, focusing specifically on software weakness types and associated risk tags. It collects a comprehensive history of reported vulnerabilities, including authentication bypasses, data exposure issues, and logic flaws identified by researchers and vendors over the past several years. Readers can utilize this dataset to track the security posture of the mcp-atlassian ecosystem, analyze the frequency and severity of specific weakness classes, and review the complete vulnerability history to assess potential risks before implementation. The data serves as a neutral reference point for security teams, developers, and auditors who need to understand past incidents without relying on fragmented vendor communication channels. By centralizing these reports, the page facilitates cross-referencing with known attack vectors and helps organizations prioritize remediation efforts based on historical patterns. This resource is designed for technical stakeholders requiring accurate, unfiltered access to security records for due diligence and compliance verification purposes.

Vendor: sooperset

CVE ID Title CVSS Severity Published
CVE-2026-77246 MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path CWE-22 7.4 High 2026-09-22
CVE-2026-77248 MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport CWE-22 8.6 High 2026-09-22
CVE-2026-77256 MCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umask CWE-732 8.3 High 2026-09-22
CVE-2026-77249 MCP Atlassian: Incomplete fix for CVE-2026-27826: redirect-based SSRF via unhooked requests session in Jira user-permission lookup CWE-918 5.3 Medium 2026-09-22
CVE-2026-77259 MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials CWE-22 7.7 High 2026-09-22
CVE-2026-77268 MCP Atlassian: Insecure File Permissions on OAuth Token Storage CWE-732 5.5 Medium 2026-09-22
CVE-2026-77247 MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters CWE-73 8.3 High 2026-09-22
CVE-2026-77272 MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler CWE-79 5.4 Medium 2026-09-22
CVE-2026-77269 MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825) CWE-22 6.5 Medium 2026-09-22
CVE-2026-77266 MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call CWE-22 6.5 Medium 2026-09-22
CVE-2026-77255 MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue CWE-22 8.6 High 2026-09-22
CVE-2026-77262 MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of CVE-2026-27825) CWE-22 8.6 High 2026-09-22
CVE-2026-77254 MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials CWE-306 9.1 Critical 2026-09-22
CVE-2026-77253 MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files CWE-22 7.1 High 2026-09-22
CVE-2026-77257 MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths CWE-22 8.3 High 2026-09-22
CVE-2026-77261 MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches CWE-918 7.1 High 2026-09-22
CVE-2026-77260 MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira) CWE-22 8.3 High 2026-09-22
CVE-2026-77271 MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825) CWE-22 8.3 High 2026-09-22
CVE-2026-77242 MCP Atlassian: Incomplete fix for CVE-2026-27826: DNS rebinding bypasses SSRF validation (validated IP not pinned) CWE-367 7.5 High 2026-09-22
CVE-2026-77243 MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass CWE-862 8.8 High 2026-09-22
CVE-2026-77251 MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud) CWE-1276 8.3 High 2026-09-22
CVE-2026-77252 MCP Atlassian: JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER can be bypassed in search tools CWE-284 6.5 Medium 2026-09-22
CVE-2026-77267 mcp-atlassian has an incomplete SSRF remediation CWE-918 8.3 High 2026-09-22
CVE-2026-77250 MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions CWE-312 6.1 Medium 2026-09-22
CVE-2026-77244 [mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token CWE-287 10.0 Critical 2026-09-22
CVE-2026-77265 MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow CWE-918 5.9 Medium 2026-09-22
CVE-2026-77270 MCP Atlassian: Arbitrary File Read via Upload Attachment Tools CWE-22 6.5 Medium 2026-09-22
CVE-2026-77258 MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path() CWE-22 7.7 High 2026-09-22
CVE-2026-77274 MCP Atlassian: SSRF Protection Bypass CWE-918 8.8 High 2026-09-22
CVE-2026-73497 MCP Atlassian is a Model Context Protocol (MCP): DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826): unauthenticated SSRF to cloud metadata CWE-918 6.5 Medium 2026-09-14

All 34 known CVE vulnerabilities affecting mcp-atlassian with full Chinese analysis, references, and POCs where available.